IBM Guardium STAP does not connect properly and does not show in the S-TAP Control - I see some specific errors in some log files. - United States  TECHNOTE (FAQ)

QUESTION
 What can cause an STAP to fail to connect properly - I get the following messages in the logs:-

/tmp/guard_stap.stderr.txt on the DB Server :-
"Server <ip_addr> wasn't heard from for nn sec during this attempt (nnn sec total), closing and re-opening"

and from the Guardium Appliance - via fileserver in the /log/opt-ibm-guardium-log/snif/snif.log
"Unauthorized client connecting from <ip_addr> ,rejecting"

CAUSE
One reason for these errors could be that the S-TAP Approval Needed is checked in the S-TAP Certification screen on the Appliance like this :-
[/support/docview.wss?uid=swg22009818&aid=1] [/support/docview.wss?uid=swg22009818&aid=1]

ANSWER
Uncheck the Approval box and the S-TAPs should start connecting .

[/support/docview.wss?uid=swg22009818&aid=2] [/support/docview.wss?uid=swg22009818&aid=2]

Question:
Installed an STAP on a DB Server but it does not show up on my Appliance in S-TAP Control etc

Installed an STAP on a DB Server but it does not show up on my Appliance in S-TAP Control etc

I get the following messages in the logs:-

/tmp/guard_stap.stderr.txt on the DB Server :- "Server wasn't heard from for nn sec during this attempt nnn sec total), closing and re-opening"

and from the Guardium Appliance - via fileserver in the /log/opt-ibm-guardium-log/snif/snif.log "Unauthorized client connecting from ,rejecting"

Answer: Uncheck the Approval box and the S-TAPs should start connecting .


IBM Important Information about the WebSphere MQ Configuration Agent, Withdrawn from IBM OMEGAMON for Messaging on z/OS V7.5 - United States  PRODUCT DOCUMENTATION

ABSTRACT
 Starting with V7.5, IBM OMEGAMON for Messaging on z/OS no longer delivers the component called WebSphere MQ Configuration Agent, referred to as MQ Configuration in the rest of this document, because there are other recommended ways to configure IBM MQ. It is stabilized in the previous V7.3 release, but MQ Configuration will be supported as long as V7.3 is in support. The components in V7.5 are the IBM MQ Monitoring Agent and the IBM Integration Bus Monitoring Agent, both of which have enhancements in V7.5 that address monitoring requirements you may have. You can upgrade your OMEGAMON for Messaging monitoring components to V7.5 while using the previous release of MQ Configuration.

Whether or not you want to continue using MQ Configuration when you install and configure OMEGAMON for Messaging V7.5, there may be steps you need to take, so please review this document prior to installing and configuring V7.5.

CONTENT
First, please determine whether you have previously installed and configured the MQ Configuration component. If you have not done so previously, there is no need for you to consider the rest of this document. For this determination, please examine the following:

· SMP/E: Are the FMIDs for MQ Configuration installed? The FMIDs are HKMC730 and HKCF730, or HKMC710 and HKCF710 if you are using the V7.1 level.
· PARMGEN: In your PARMGEN configuration for each runtime environment, does the “Include Products in this PARMGEN RTE panel (KCIP@PGI)” (under step “1 KCIJPCFG Set-up/Refresh PARMGEN work environment” navigation from the PARAMETER GENERATOR (PARMGEN) WORKFLOW - PRIMARY OPTION MENU), have the line for “KMC OMEGAMON for Messaging – WebSphere MQ Configuration” selected for configuration in the environment?

If the answers are “yes” to both of the above questions, then you do need to continue with the following general steps, which are documented in detail below:

1) Determine whether there are any users of MQ Configuration in your environment. There are many cases in which the MQ Configuration component is installed and configured in PARMGEN, but no one is actually using it. It is important to determine this in order to decide which step to take next.

2) If you do not have users of MQ Configuration, or you want to remove it anyway, there may be steps required when you are installing and configuring OMEGAMON for Messaging V7.5 especially if you previously configured a shared agent address space for MQ monitoring (KMQ) and MQ configuration (KMC) agents.

3) If you do have users of MQ Configuration and want to continue supporting that usage, you need to follow recommendations when you are installing and configuring OMEGAMON for Messaging V7.5 upgraded products.

Here are the details:

1) Suggested ways to determine whether there are any users of MQ Configuration:

a. In the Tivoli Enterprise Portal (TEP), using an administrator user ID, click Edit->Administer Users to check whether any users or groups have access to the Configuration navigator view. For users and/or groups that have been configured for TEP, check the Navigator Views tab to see if any of them have “Configuration” in their Assigned Views. If no one is allowed access to the Configuration navigator, then they are not using MQ Configuration feature.

b. Another item to check in Administer Users is whether any user or group has the Permissions tab showing that View or Modify permission has been authorized for WebSphere MQ Configuration Authorities “Configure” authority. Some user or group should have permission to use this feature if it is used by anyone.

c. Check whether there are configured names that reflect queue managers in your environment. Click on the Configuration navigator in the view drop-down list in the Navigator pane, then click on Defined View on the left. In the middle Defined Tree pane on the workspace, expand the various “+” items, and with the help of someone who knows MQ queue managers in your environment, see if any of the expanded items reflect queue managers actually in your environment. There will be default and example items shipped with the product, but you are looking for names reflecting MQ at your site. If there are no names that reflect queue managers in your environment, then no one is using MQ Configuration.

d. If it appears that there is usage of MQ Configuration, it would still be good to check with MQ users at your site to see if they actually require it. Perhaps they have experimented with it but do not actually use it regularly. If the OMEGAMON feature for MQ Configuration is not absolutely required in your environment, the recommendation would be to review all the ways that the IBM MQ product offers to configure and administer MQ, some of which are new in recent releases. Also, remember that the OMEGAMON MQ Monitoring agent offers the Take Action facility to issue any MQSC configuration command if the user is authorized.

2) If there are no users of MQ Configuration, or you want to remove it anyway:

a. If you use a Serverpac that contains the upgraded OMEGAMON for Messaging V7.5 components to install, the MQ Configuration FMIDs (HKMC730 and HKCF730) are not installed because they are not included in the Serverpac. However, depending on your previous configuration, the missing MQ Configuration component could cause unexpected results in your LPAR runtime environment (RTE), so check and act on the following items prior to installation and configuration of OMEGAMON for Messaging V7.5:

1. If your Hub TEMS is configured on the z/OS platform and there are RKCF* DDNAME statements in your existing Hub TEMS started task JCL, update the TEMS started task JCL to remove those RKCF* DDNAME statements.

2. If MQ Configuration (KMC) and MQ Monitoring (KMQ) agents are running in a shared agent address space, make sure that the owner of that address space is the MQ Monitoring agent. For the MQ Monitoring agent to be the owner, the related PARMGEN LPAR RTE profile parameters for OMEGAMON for Messaging components may need adjusting, as depicted in the following example before and after settings:

Before (MQ Configuration owns the Agent address space called OMEGMQ):
ISREDDE2 %RTE_PLIB_HILEV%.%RTE_NAME%.WCONFIG(%RTE_NAME%)
Command ===>
KMC_AGT_STC OMEGMQ
KMC_AGT_STC_OWNER “”
KMQ_AGT_STC “”
KMQ_AGT_STC_OWNER OMEGMQ

After (MQ Monitoring owns the Agent address space called OMEGMQ):
ISREDDE2 %RTE_PLIB_HILEV%.%RTE_NAME%.WCONFIG(%RTE_NAME%)
Command ===>
KMQ_AGT_STC OMEGMQ
KMQ_AGT_STC_OWNER “”

Tip: Please review the SMPE06 upgrade scenario [https://www.ibm.com/support/knowledgecenter/SSAUBV/com.ibm.omegamon_share.doc_6.3.0.2/parmgenref/smpe06_parmgenref.htm?pos=2] in the OMEGAMON Shared Knowledge Center as part of deploying these changes. You can use the refreshed OMEGMQ OMEGAMON for Messaging – KMQ Agent-only address space in the RTE’s W/RKANSAMU dataset for refreshing the original shared address space in your system procedure library. The only delta would be the RKMCAPLA DDNAME, which can be staged for removal.

b. If you install OMEGAMON for Messaging V7.5 as a CBPDO into an existing SMP/E CSI, the MQ Configuration FMIDs will remain installed, but since you are not using MQ Configuration, it is recommended you follow these steps:

1. If MQ Configuration (KMC) and MQ Monitoring (KMQ) agents are running in a shared agent address space, make sure that the owner of that address space is the MQ Monitoring agent. See item a.2 above for more details.

2. In the “Include Products in this PARMGEN RTE panel (KCIP@PGI)” (under step “1 KCIJPCFG Set-up/Refresh PARMGEN work environment” navigation from the PARAMETER GENERATOR (PARMGEN) WORKFLOW - PRIMARY OPTION MENU), deselect the line with “KMC OMEGAMON for Messaging – WebSphere MQ Configuration” so that it will be removed from the runtime environment (RTE) during reconfiguration/upgrade of the RTE. Follow one of the SMPEnn upgrade scenarios [https://www.ibm.com/support/knowledgecenter/SSAUBV/com.ibm.omegamon_share.doc_6.3.0.2/parmgenref/smpe04_parmgenref.htm?pos=2] documented in the OMEGAMON Shared Knowledge Center.

Tip: Prior to upgrading the RTE, you also have the option to SMP/E delete the HKMC730 and HKCF730 FMIDs from the existing CSI. When you start the PARMGEN configuration phase of the upgrade, the inexistence of these deleted FMIDs is PARMGEN’s trigger to delete the product from the RTE upon reconfiguration following any of the SMPEnn upgrade scenarios (SMPE04 [https://www.ibm.com/support/knowledgecenter/SSAUBV/com.ibm.omegamon_share.doc_6.3.0.2/parmgenref/smpe04_parmgenref.htm?pos=2], SMPE05 [https://www.ibm.com/support/knowledgecenter/SSAUBV/com.ibm.omegamon_share.doc_6.3.0.2/parmgenref/smpe05_parmgenref.htm?pos=2] or SMPE06 [https://www.ibm.com/support/knowledgecenter/SSAUBV/com.ibm.omegamon_share.doc_6.3.0.2/parmgenref/smpe06_parmgenref.htm?pos=2]).

3) If there are users of MQ Configuration, and you want to continue supporting that usage:

a. It is highly recommended that you install OMEGAMON for Messaging V7.5 as a CBPDO into the existing SMP/E CSI so that MQ Configuration remains available. If you do this, there are no other steps required, however, the following step is also highly recommended:

1. If MQ Configuration (KMC) and MQ Monitoring (KMQ) agents are running in a shared agent address space, separate them into their own address spaces, since they will be running at different product levels. For this, the related PARMGEN LPAR RTE profile parameters for OMEGAMON for Messaging components may need adjusting to be like the following example in which MQ Configuration is running in an address space called OMEGMC and MQ Monitoring is running in an address space called OMEGMQ:

ISREDDE2 %RTE_PLIB_HILEV%.%RTE_NAME%.WCONFIG(%RTE_NAME%)
Command ===>
KMC_AGT_STC OMEGMC
KMC_AGT_STC_OWNER “”
KMQ_AGT_STC OMEGMQ
KMQ_AGT_STC_OWNER “”

b. If you were to install OMEGAMON for Messaging V7.5 in a Serverpac, you would need to retain your old SMP/E CSI and maintain a separate PARMGEN runtime environment in order to use MQ Configuration separately. This may be acceptable to you if you already separate MQ Configuration from the rest of your monitoring infrastructure, with its own Hub TEMS, etc. In this case, for the configuration that will contain OMEGAMON for Messaging V7.5, please see item 2 above, steps a.1 and a.2 in case they would apply to that particular configuration.

c. OMEGAMON for Messaging V7.5 application support does not include application support for the MQ Configuration component. If you need to re-install application support for MQ Configuration for any reason, you should use the latest V7.3 level of application support. For z/OS customers, that is available with DVD LCD7-3513-08 at the following link: ftp://public.dhe.ibm.com/software/tivoli_support/misc/PandA/tools_agent/tools/appsupt/ [ftp://public.dhe.ibm.com/software/tivoli_support/misc/PandA/tools_agent/tools/appsupt/]

For more information about OMEGAMON for Messaging V7.5, please see this link to the product documentation:
https://www.ibm.com/support/knowledgecenter/SSRLD6_7.5.0/welcome_omxe_msg750.html [https://www.ibm.com/support/knowledgecenter/SSRLD6_7.5.0/welcome_omxe_msg750.html]

For more information about OMEGAMON installation and configuration with PARMGEN, please see this link to the shared documentation:
https://www.ibm.com/support/knowledgecenter/SSAUBV/com.ibm.omegamon_share.doc_6.3.0.2/shared_welcome/welcome.htm?pos=2 [https://www.ibm.com/support/knowledgecenter/SSAUBV/com.ibm.omegamon_share.doc_6.3.0.2/shared_welcome/welcome.htm?pos=2]

For more information about recommended ways to configure IBM MQ, please see the following links:
Administering IBM MQ [https://www.ibm.com/support/knowledgecenter/SSFKSJ_9.0.0/com.ibm.mq.adm.doc/q019950_.htm]
Configuring queue managers on z/OS [https://www.ibm.com/support/knowledgecenter/SSFKSJ_9.0.0/com.ibm.mq.con.doc/q019070_.htm]
Using IBM z/OSMF to automate IBM MQ [https://www.ibm.com/support/knowledgecenter/SSFKSJ_9.0.0/com.ibm.mq.con.doc/q019925_.htm]
Support continuous configuration deployments for IBM MQ with UrbanCode [https://www.ibm.com/developerworks/library/d-continuous-configuration-deployments-urbancode-mq-trs/index.html]

ORIGINAL PUBLICATION DATE
 2017/10/26

Question:
PARMGEN ABEND S013 in JOB KCIJPALO

After installing IBM OMEGAMON for Messaging on z/OS 07.05.00, I receive the following ABEND after submitting PARMGEN Job KCIJPALO:

      JOB02175  IEC141I 013-18,IGG0191B,U600861X,KMCJPALR,RKPDIN,600D,ISMS01,  083
         083             HSYS.S002.OMGNEW.TKANPAR(KMCPDICT)
     JOB02175  IEA995I SYMPTOM DUMP OUTPUT  085
         085             SYSTEM COMPLETION CODE=013  REASON CODE=00000018
         085              TIME=07.41.33  SEQ=00630  CPU=0000  ASID=004C
         085              PSW AT TIME OF ERROR  075C1000   80E9E456  ILC 2  INTC 0D
         085                NO ACTIVE MODULE FOUND
         085                NAME=UNKNOWN
         085                DATA AT PSW  00E9E450 - 4100302C  0A0D010D  A7E5014B
         085                AR/GR 0: 009FF028/00E9E760   1: 00000000/A4013000
         085                      2: 00000000/00081CB8   3: 00000000/00E9E734
         085                      4: 00000000/009B1410   5: 00000000/009B17A4
         085                      6: 00000000/009B174C   7: 00000000/009B17A4
         085                      8: 00000000/009B176C   9: 00000000/00000080
         085                      A: 00000000/00F20E10   B: 00000000/009B10FC
         085                      C: 00000000/00000008   D: 00000000/00000000
         085                      E: 00000000/80E9DCB4   F: 00000000/00000018
         085              END OF SYMPTOM DUMP

What is the cause of this?

Answer: Starting with V7.5, IBM OMEGAMON for Messaging on z/OS no longer delivers the component called WebSphere MQ Configuration Agent, referred to as MQ Configuration in the rest of this document, because there are other recommended ways to configure IBM MQ.


IBM SCA destinations for IBM Business Process Manager (BPM), WebSphere Process Server (WPS) and WebSphere Enterprise Service Bus (WESB) are not preserved when uninstalling and reinstalling a service module - United States SCA.RecycleDestinations; custom properties; SCA destinations; event sequencing; SCA modules; message queue TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 When a Service Component Architecture (SCA) module is uninstalled, by default, its associated destinations are removed, even if there are still messages in the destination queue. In some situations, such as when Event Sequencing is used, messages on the destinations must be preserved.

RESOLVING THE PROBLEM
To resolve this issue, use the SCA.recycleDestinations custom Java™ virtual machine (JVM) property for the module. Set the property to false to preserve SCA destinations.

Cross reference information Segment Product Component Platform Version Edition Business Integration WebSphere Process Server AIX, HP-UX, Linux, Linux zSeries, Solaris, Windows, z/OS 7.0.0.5 Business Integration WebSphere Enterprise Service Bus SCA AIX, HP-UX, Linux, Linux zSeries, Solaris, Windows, z/OS 7.5, 7.0.0.5
PRODUCT ALIAS/SYNONYM
 BPM
WPS
WESB

Question:
Updating SCA applications & internal SCA module queues

When updating an existing SCA module using the ISC, I noticed that internal SCA queues (sca/<module>/...) on the SCA.SYSTEM bus) are deleted and recreated.

Does this mean that any messages that may still reside on these internal queues would be deleted on a module update? If so, when updating SCA modules in a production environment, should these internal queues be monitored to be empty before updating a SCA module (to prevent loosing messages)?

Answer: To resolve this issue, use the SCA.recycleDestinations custom Java™ virtual machine (JVM) property for the module. Set the property to false to preserve SCA destinations.


IBM Security Bulletin: IBM WebSphere MQ MQXR insecure passwords (CVE-2015-2012) - United States  SECURITY BULLETIN

SUMMARY
 The Telemetry (MQXR) service can be configured to use SSL/TLS connections - the passphrase used to access the keystore is written to the file system in clear text in a properties file that is world readable.

VULNERABILITY DETAILS
CVEID: CVE-2015-2012 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2012]
DESCRIPTION: IBM WebSphere MQ stores the MQXR keystore password in clear text in a world readable file.
CVSS Base Score: 2.1
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/103923 [http://xforce.iss.net/xforce/xfdb/103923] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)

AFFECTED PRODUCTS AND VERSIONS
IBM WebSphere MQ 8.0

 * 8.0.0.3 and earlier maintenance levels

IBM WebSphere MQ 7.5  * 7.5.0.5 and earlier maintenance levels

IBM WebSphere MQ 7.1  * 7.1.0.6 and earlier maintenance levels

REMEDIATION/FIXES
IBM WebSphere MQ 8.0

Install fixpack 8.0.0.4 [http://www-01.ibm.com/support/docview.wss?uid=swg21969244]
IBM WebSphere MQ 7.5  * Apply Interim fix IT09866 [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+MQ&release=7.5.0.5&platform=All&function=aparId&apars=IT09866]

IBM WebSphere MQ 7.1  * Install fixpack 7.1.0.7 [http://www-01.ibm.com/support/docview.wss?uid=swg21965293]

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0] RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/PSIRT] CHANGE HISTORY
 01 February 2016: Original Copy Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

RELATED INFORMATION
 A Japanese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21977183]

Question: Help with Security Bulletin: IBM WebSphere MQ MQXR insecure passwords (CVE-2015-2012) I need to understand details regarding Security Bulletin: IBM WebSphere MQ MQXR insecure passwords (CVE-2015-2012). Where can I find this information?

Answer:
CVEID: CVE-2015-2012 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2012]
DESCRIPTION: IBM WebSphere MQ stores the MQXR keystore password in clear text in a world readable file.
CVSS Base Score: 2.1
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/103923 [http://xforce.iss.net/xforce/xfdb/103923] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)


IBM HTTP Session time-out settings and overwrite precedence rules - United States WebSphere http session management time-out wasrun precedence overwrite TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 It is possible to set the HTTP Session time-out in various places on the IBM® WebSphere® Application Server Administrative Console. It is also possible to set HTTP Session time-out for the application packaging process.

Since Session time-out can be set in multiple places, it is necessary to understand how the ultimate Session time-out for an application is determined.

CAUSE
Application needs HTTP session time-out set.

RESOLVING THE PROBLEM
The HTTP Session time-out can be set in the following places:

 * From the Administrative Console at the server, Enterprise application, and Web application levels
 * At the time when the application is packaged
 * In the application code

Setting the HTTP Session time-out from the Administrative Console
1. To set the HTTP Session time-out at the server level, navigate to Servers > Application Servers > Your Server > Web Container > Session Management.

In the Session time-out section of this window, you can select No time-out or Set time-out by clicking the appropriate radio button. If you choose to set the time-out, type the desired value in minutes in the box.

2. To set the HTTP Session time-out at the Enterprise Application level, navigate to Applications > Enterprise Applications > Your Application > Session Management.

Check Override in the Override Session Management section, then select to set the time-out and the time-out value. This sets the application session to overwrite those values set at the parent, which in this case is the Server level.

3. To set the HTTP Session time-out at the Web Application level, navigate to Applications > Enterprise Applications > Your Application > Web Module > Your Web App.war > Session Management.

Check Override in the Override Session Management section, then select to set the time-out and the time-out value. This sets the Application Session to overwrite those values set at the parent levels, which in this case is the Server or Enterprise Application level.

After modifying these settings, save the master configuration.

Setting HTTP Session time-out when application is packaged

The application developer can also select to set the HTTP Session time-out parameter when the application is packaged. This value is stored in the web.xml file for the Web application.

This setting overrides any session time-outs defined from the Administrative Console. Alter this setting by repackaging the application with a new value, or by modifying the web.xml file. The entry in the web.xml will be as follows:
          <session-config>
      *          <session-timeout>60</session-timeout>
 *
 *       </session-config>

Where the "session-timeout" is an integer value for the desired session time-out in minutes.
Setting HTTP Session time-out from the application code

Finally, the HTTP Session time-out can be set in the application code. The programmer can invoke the setMaxInactiveInterval() method on HttpSession object to set the time-out value as desired. This setting overrides any time-out defined in the application package or made from the Administrative Console.

HTTP Session time-out Override Precedence Summary

The list below shows the precedence from which the final HTTP Session time-out is derived.

1. Server Level [/support/docview.wss?uid=swg21163875&aid=1] Lowest level 2. Enterprise Application [/support/docview.wss?uid=swg21163875&aid=1] Overrides the Server Level if Override is selected 3. Web Application [/support/docview.wss?uid=swg21163875&aid=1] Overrides the Server and Enterprise Application settings if Override is selected 4. Application Level (web.xml) [/support/docview.wss?uid=swg21163875&aid=1] Overrides Server, Enterprise Application, and Web Application settings 5. Application Code [/support/docview.wss?uid=swg21163875&aid=1] Overrides all other settings RELATED INFORMATION
 A simplified Chinese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21659740]

Cross reference information Segment Product Component Platform Version Edition Application Servers Runtimes for Java Technology Java SDK

Question: How to increase the HTTP Session time-out value for Workplace application on WebSphere Application Server? We would like to increase the HTTP Session time-out value for our Workplace application. Where are all the locations that this value is set and what are their precedence?

Answer:
The HTTP Session time-out can be set in the following places:

 * From the Administrative Console at the server, Enterprise application, and Web application levels
 * At the time when the application is packaged
 * In the application code


IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM WebSphere MQ Internet Passthru (CVE-2015-4000) - United States  SECURITY BULLETIN

SUMMARY
 The Logjam Attack on TLS connections using the Diffie-Hellman (DH) key exchange protocol affects IBM WebSphere MQ Internet Pass-thru (MQIPT).

VULNERABILITY DETAILS
CVEID: CVE-2015-4000 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000]
DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHE_EXPORT ciphersuite choice. An attacker could exploit this vulnerability using man-in-the-middle techniques to force a downgrade to 512-bit export-grade cipher. Successful exploitation could allow an attacker to recover the session key as well as modify the contents of the traffic. This vulnerability is commonly referred to as "Logjam".
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103294 [https://exchange.xforce.ibmcloud.com/vulnerabilities/103294] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

AFFECTED PRODUCTS AND VERSIONS
The affected ciphersuite is available in all versions of IBM WebSphere MQ Internet Pass-thru (MQIPT) prior to 2.1.0.2

REMEDIATION/FIXES
SupportPac MS81: IBM WebSphere MQ Internet Pass-Thru
Users of IBM WebSphere MQ Internet Pass-Thru 2.1.0.1, 2.0 and older releases should first upgrade to IBM WebSphere MQ Internet Pass-Thru 2.1.0.2 [http://www.ibm.com/support/docview.wss?uid=swg24006386].

WORKAROUNDS AND MITIGATIONS
None.

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]
RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt] ACKNOWLEDGEMENT
Reported to IBM by the WeakDH team at https://weakdh.org [https://weakdh.org]

CHANGE HISTORY
 11th June 2015: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

RELATED INFORMATION
 A Japanese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21962347]

Question: Help with Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM WebSphere MQ Internet Passthru (CVE-2015-4000) I need to understand details regarding Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM WebSphere MQ Internet Passthru (CVE-2015-4000). Where can I find this information?

Answer:
CVEID: CVE-2015-4000 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000]
DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHE_EXPORT ciphersuite choice. An attacker could exploit this vulnerability using man-in-the-middle techniques to force a downgrade to 512-bit export-grade cipher. Successful exploitation could allow an attacker to recover the session key as well as modify the contents of the traffic. This vulnerability is commonly referred to as "Logjam".
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103294 [https://exchange.xforce.ibmcloud.com/vulnerabilities/103294] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)


IBM Action required for IBM Integration Bus Hypervisor Edition V9.0 and WebSphere Message Broker Hypervisor Edition V8.0 for security vulnerabilities in Red Hat Linux - United States IIB WMB FLASH (ALERT)

ABSTRACT
 IBM Integration Bus Hypervisor Edition V9.0 and WebSphere Message Broker Hypervisor Edition V8.0 require customer action for security vulnerabilities in Red Hat Linux

CONTENT
IBM Integration Bus Hypervisor Edition V9.0 and WebSphere Message Broker Hypervisor Edition V8.0 ship with versions of Red Hat Enterprise Linux (RHEL) Server that are vulnerable to
CVE-2017-14746 CVE-2017-15085 CVE-2017-15086 CVE-2017-15087 CVE-2017-15275

IBM Integration Bus Hypervisor Edition V9.0 and WebSphere Message Broker Hypervisor Edition V8.0 ship with Red Hat Enterprise Linux (RHEL) Server 6.2

Remediation:

IBM strongly recommends that you contact Red Hat to obtain and install fixes for Red Hat Enterprise Linux (RHEL) Server 6.2, as applicable.

Cross reference information Segment Product Component Platform Version Edition Business Integration WebSphere Message Broker Hypervisor Edition Linux 8.0

Question:
Help with Action required for IIB H.E. V9 & WMB H.E. V8 for security vulnerabilities in Red Hat Linux

I need to understand details regarding Action required for IBM Integration Bus Hypervisor Edition V9.0 and WebSphere Message Broker Hypervisor Edition V8.0 for security vulnerabilities in Red Hat Linux.
This is related to CVE-ID:
CVE-2017-14746
CVE-2017-15085
CVE-2017-15086
CVE-2017-15087
CVE-2017-15275

Where can I find this information?

Answer: IBM strongly recommends that you contact Red Hat to obtain and install fixes for Red Hat Enterprise Linux (RHEL) Server 6.2, as applicable.


IBM Installing the Installation Manager on an NFS mounted disk - United States NFS; remote drive; mount drive ; 1308281 TECHNOTE (FAQ)

QUESTION
 Can IBM® Installation Manager be installed on a UNIX® or Linux® NFS mounted disk?

ANSWER
Do not install the IBM Installation Manager on an NFS mounted disk.

On AIX® for example, some of the JRE folders are not being deleted when the IBM Installation Manager uninstalls but is deleted after waiting for 10 minutes. This causes the JRE folder to not be uninstalled during an uninstall operation. Other UNIX and Linux operating systems have similar issues.

Only install the Installation Manager on a local disk.

Question:
Why does my install of the latest Installation Manager on a Linux Ingram Server not function?

I've installed the latest Installation Manager on an Ingram Server that I mount to different Linux machines where I have installed WebSphere Application Server. I received the following error when trying to use the Installation Manager:

     00:02.25 ERROR [main] org.eclipse.equinox.log.internal.
     ExtendedLogReaderServiceFactory safeLogged
       Application error
       java.lang.NoClassDefFoundError: org.eclipse.jface.dialogs.
     ProgressMonitorDialog
         at java.lang.ClassLoader.defineClassImpl(Native Method)
         at java.lang.ClassLoader.defineClass(ClassLoader.java:324)
         at org.eclipse.osgi.internal.baseadaptor.DefaultClassLoader.
     defineClass(DefaultClassLoader.java:188)
         at org.eclipse.osgi.baseadaptor.loader.ClasspathManager.
     defineClassHoldingLock(ClasspathManager.java:632)

I have unmounted and remounted the drive but does not appear to resolve the issue.

Answer: Only install the Installation Manager on a local disk.


IBM How to find details of Corrupted Object from the entries in db2diag.log? - United States  TECHNOTE (FAQ)

QUESTION
 How to find details of Corrupted Object from the entries in db2diag.log?

ANSWER
When we have corruption in the database we may received following kind of entries in db2diag.log
These also notify object where we t where we have detected corruption in the Database.

Sample db2diag.log entry for Corruption.

2016-05-04-03.13.05.261082-360 I3442A358 LEVEL: Error
PID : 393470 TID : 1 PROC : db2pfchr 0
INSTANCE: db2inst1 NODE : 000
FUNCTION: DB2 UDB, buffer pool services, sqlbReadAndReleaseBuffers,probe:13
RETCODE : ZRC=0x86020001=-2046689279=SQLB_BADP "page is bad"
DIA8400C A bad page was encountered.

2016-05-04-03.13.05.264301-360 I3801A437 LEVEL: Error
PID : 393470 TID : 1 PROC : db2pfchr 0
INSTANCE: db2inst1 NODE : 000
FUNCTION: DB2 UDB, buffer pool services, sqlbReadAndReleaseBuffers,
probe:13
DATA #1 : String, 158 bytes
Obj={pool:3;obj:21;type:0} State=x27 Parent={3;21}, EM=1120, PP0=1152
Page=51235 Cont=17 Offset=2848 BlkSize=15
sqlbReadAndReleaseBuffers error: num-pages=16

Based on this information dumped in db2diag.log entry we can Identify {pool:3;obj:21;type:0} is the Object is corrupted.

e.g. Obj={pool:3;obj:21;type:0}

Pool = Tablespace ID
Obj = Object ID
Type = Type of the Object

If Type is 0 its Table Object ,If its 1 then its Index.

We can find the Name of the Object using following query, to further backup the Definition for future reference.

db2 "select char(tabname,20), char(tabschema,20) from syscat.tables where tableid=<ObjectID> and tbspaceid=<Tablepace id>"

Obj={pool:3;obj:21;type:0}
db2 "select char(tabname,20), char(tabschema,20) from syscat.tables where tableid=21 and tbspaceid=3"

RELATED INFORMATION
 SYSCAT.TABLES catalog view [http://www.ibm.com/support/knowledgecenter/SSEPGG_10.1.0/com.ibm.db2.luw.sql.ref.doc/doc/r0001063.html?lang=en]

Question: How to find details of Corrupted Object from the entries in db2diag.log? We have corruption in DB2 Database and got entries for corrupted Object in db2diag.log ,Need to find details of the Object using information dumped in db2diag.log

Answer:
When we have corruption in the database we may received following kind of entries in db2diag.log
These also notify object where we t where we have detected corruption in the Database.


IBM JMSExceptions CWSIT0006E and CWSIA0241E on bus connect - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Your application throws JMS exceptions CWSIT0006E and CWSIA0241E when trying to connect to a WebSphere Application Server (WAS) Service Integration Bus (SIBus).

SYMPTOM
Application throws the following JMS exceptions in the stack trace while trying to connect to the SIBus:

JMSException caught
javax.jms.JMSException: CWSIA0241E: An exception was received during the call to the method
JmsManagedConnectionFactoryImpl.createConnection:
com.ibm.websphere.sib.exception.SIResourceException: CWSIT0006E: It is not possible to contact
a messaging engine in bus YOURBUS..
at
com.ibm.ws.sib.api.jms.impl.JmsManagedConnectionFactoryImpl.createConnection(JmsManagedConnectionFactoryImpl.java:225)
at
com.ibm.ws.sib.api.jms.impl.JmsManagedConnectionFactoryImpl.createConnection(JmsManagedConnectionFactoryImpl.java:148)

CAUSE
This can be caused by a stopped messaging engine, a wrong or misspelled bus name (case-sensitive) in the connection factory settings or, the HA manager is not able to find the running messaging engine.

RESOLVING THE PROBLEM
The error messages CWSIA0241E and CWSIT0006E indicate that when the connection was attempted, there were no running messaging engines available on the specified bus. To see why the messaging engines were not available, check the SystemOut.log for applicable messages. Examine the SystemOut.log file starting at the time period when the application experienced the problem and search backward.

Check for the CWSID0016I which indicates status of the Messaging Engine activity. You may see messages like this:

SibMessage I [:] CWSID0016I: Messaging engine [mename]is in state Stopping.
SibMessage I [:] CWSID0016I: Messaging engine [mename]is in state Stopped.

The solution for this problem is to start the messaging engine.

If the messaging engine is running and you still see these errors at the application side, other possible reasons for this problem are:

1) Check provider end points. The value for the provider endpoints should be in the format of host_name:port_number:BootstrapBasicMessaging.

In the JMS connection factory, you can define a list of provider endpoints that govern which servers the application will attempt to connect to. If you have defined these endpoints, ensure that the messaging engines for these servers have all started and that the port and transport chains defined in the endpoint list are correct. Also, ensure that the values for the Connection proximity (bus, cluster, host or server) and the Target groups and Target significance settings are appropriate. For example, if the Target significance value is Required and no suitable messaging engine could be located, then this would cause a connection failure. Please refer to the following links for how to set provider endpoints:

Default messaging provider queue connection factory [Settings] : [https://www.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/SIBJMSQueueConnectionFactory_DetailForm.html]

Default messaging provider topic connection factory [Settings]: [https://www.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/SIBJMSTopicConnectionFactory_DetailForm.html]

Restart the server after making the change.

2) If your environment is heavily loaded, the HA manager might not be able to locate the running messaging engine within three seconds. In this case, check if there are any hung threads in the SystemOut.log, and resolve them if possible. Next, consider increasing the value of sib.trm.linger from three to give the HA manager more time to locate a messaging engine.

Tune the sib.trm.linger property value in the sib.properties file to set the messaging engine lookup delay so that the Work Load Manager (WLM) waits for a longer period of time before returning an error. Please refer to information below on how to set this property in the sib.properties.

1)<WAS_HOME>/properties : The properties declared under this location would be applicable to all the profiles in that installation.

2)<PROFILE_ROOT>/properties : The properties declared here are applicable for all the servers on this profile

If a property is defined at both <PROFILE_ROOT>/properties and <WAS_HOME>/properties, then the property defined at <PROFILE_ROOT>/properties would take precedence.

After resetting the property you must restart the server.

Cross reference information Segment Product Component Platform Version Edition Business Integration WebSphere MQ Not Applicable Business Integration WebSphere Process Server Business Integration WebSphere Service Registry and Repository Business Integration IBM Business Process Manager Standard Business Integration WebSphere Enterprise Service Bus Business Integration WebSphere Partner Gateway Advanced Edition Configuration Business Integration WebSphere MQ Configuration
PRODUCT ALIAS/SYNONYM
 WebSphere Application Server WAS SIB SIBUS SI BUS

Question:
WAS 8.5.x - Writing a JMS message to a remote queue takes a long time. How to write the message faster?

We are writing a jms message from a websphere cell (cellA) to a queue hosted by another websphere cell (cellB). Sometimes we noticed that writing a message is very slow. Usually when a local queue will be used the time to write this messages is about 8 ms, but if the queue is located on a other cell is took significant longer (about 3000ms+ ).

Our findings: After enabling following trace "=info: com.ibm.ws.sib.trm.=finest" the problem is related to:
- com.ibm.ws.cluster.selection.NoAvailableTargetExceptionImpl
- WaitForWLMDat 3 (com.ibm.ws.sib.trm.wlm.client.WaitForWLMData) [:] Sleeping for 2999 ms "

Because of the sleep time the writing to the queue is slowed down. How to prevent the sleeping time of 3 seconds, when writing a message to a remote queue?

Answer:
If your environment is heavily loaded, the HA manager might not be able to locate the running messaging engine within three seconds. In this case, check if there are any hung threads in the SystemOut.log, and resolve them if possible. Next, consider increasing the value of sib.trm.linger from three to give the HA manager more time to locate a messaging engine.

Tune the sib.trm.linger property value in the sib.properties file to set the messaging engine lookup delay so that the Work Load Manager (WLM) waits for a longer period of time before returning an error. Please refer to information below on how to set this property in the sib.properties.

1)<WAS_HOME>/properties : The properties declared under this location would be applicable to all the profiles in that installation.

2)<PROFILE_ROOT>/properties : The properties declared here are applicable for all the servers on this profile

If a property is defined at both <PROFILE_ROOT>/properties and <WAS_HOME>/properties, then the property defined at <PROFILE_ROOT>/properties would take precedence.

After resetting the property you must restart the server.


IBM Configuring logging for Atlas Extensions in Atlas 6.0.3.3 - United States  TECHNOTE (FAQ)

QUESTION
 How do I configure logging for Atlas Extensions in Atlas 6.0.3.3?

CAUSE
Atlas Extensions log files are not being generated

ANSWER
In Atlas 6.0.3.3, the Atlas Extensions logging configuration has moved to log4j.properties file.

 1. Navigate to <Atlas_Install_folder>/Atlas/Properties folder
 2. Edit log4.properties file
 3. Update the path Information for the following three properties  1. log4j.appender.MATTER_APPENDER.File=matter_adapter.log
     2. log4j.appender.PERSON_APPENDER.File=person_adapter.log
     3. log4j.appender.ORG_UNIT_APPENDER.File=org_unit_adapter.log

 4. Save the file
 5. Restart Atlas application server

Question: How do I configure logging for Atlas Extensions in Atlas 6.0.3.3? How do I configure logging for Atlas Extensions in Atlas 6.0.3.3?

Answer:
In Atlas 6.0.3.3, the Atlas Extensions logging configuration has moved to log4j.properties file.

 1. Navigate to <Atlas_Install_folder>/Atlas/Properties folder
 2. Edit log4.properties file
 3. Update the path Information for the following three properties  1. log4j.appender.MATTER_APPENDER.File=matter_adapter.log
     2. log4j.appender.PERSON_APPENDER.File=person_adapter.log
     3. log4j.appender.ORG_UNIT_APPENDER.File=org_unit_adapter.log

 4. Save the file
 5. Restart Atlas application server


IBM Security Bulletin: IBM Integration Bus and WebSphere Message Broker, upon installation, set incorrect permissions for an object on unix platforms ( CVE-2016-0394 ) - United States WMB IIB SECURITY BULLETIN

SUMMARY
 IBM Integration Bus and WebSphere Message Broker, upon installation, set incorrect permissions for an object on unix platforms, which exposes it to an unintended actor.

VULNERABILITY DETAILS
CVEID: CVE-2016-0394 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0394]
DESCRIPTION: IBM Integration Bus and WebSphere Message broker set incorrect permissions for an object, which could allow a local attacker to manipulate certain files.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112643 [https://exchange.xforce.ibmcloud.com/vulnerabilities/112643] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

AFFECTED PRODUCTS AND VERSIONS
IBM Integration Bus V9

WebSphere Message Broker V8

REMEDIATION/FIXES

Product VRMF APAR Remediation/Fix IBM Integration Bus V9 IT14845 The APAR is available in Fix Pack 9.0.0.6 https://www-304.ibm.com/support/docview.wss?uid=swg24042598 [https://www-304.ibm.com/support/docview.wss?uid=swg24042598]

WebSphere Message Broker V8 IT14845 The APAR is available in Fix Pack 8.0.0.8
https://www-304.ibm.com/support/docview.wss?uid=swg24042925 [https://www-304.ibm.com/support/docview.wss?uid=swg24042925]
For unsupported versions of the product, IBM recommends upgrading to a fixed, supported version/release/platform of the product.

The planned maintenance release dates for WebSphere Message Broker and IBM Integration Bus are available at :
http://www.ibm.com/support/docview.wss?rs=849&uid=swg27006308 [http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006308]

WORKAROUNDS AND MITIGATIONS
To mitigate the problem with a current V8 or V9 fix pack installation on Unix platforms, you can run the following commands:

find <IIB install dir>/isadc -type d -exec chmod 755 {} \;
find <IIB install dir>/isadc -type f -exec chmod 644 {} \;
find <IIB install dir>/isadc -type f -name *.sh -print -exec chmod 755

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 28-Nov-2016 - Original version Published
04-Apr-2017 - Removed v10 (distributed) from affected list, text change to explicitly mention 'on unix platforms'

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

RELATED INFORMATION
 A Japanese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21995532]

Cross reference information Segment Product Component Platform Version Edition Business Integration WebSphere Message Broker 8.0
PRODUCT ALIAS/SYNONYM
 WMB IIB

Question: Help with Security Bulletin: IIB & WMB upon installation, set incorrect permissions for an object ( CVE-2016-0394 ) I need to understand details regarding Security Bulletin: IBM Integration Bus and WebSphere Message Broker, upon installation, set incorrect permissions for an object ( CVE-2016-0394 ) Where can I find this information?

Answer:
CVEID: CVE-2016-0394 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0394]
DESCRIPTION: IBM Integration Bus and WebSphere Message broker set incorrect permissions for an object, which could allow a local attacker to manipulate certain files.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112643 [https://exchange.xforce.ibmcloud.com/vulnerabilities/112643] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)


IBM Portal upgrades fail during ejbdeploy with 'Error is Platform not running' message - United States 7001eGA TECHNOTE (TROUBLESHOOTING)

PROBLEM
Portal upgrades fails during ejbdeploy with 'Error is Platform not running' message. This could happen for any v6.1.0.x , v7.0.0.x, or v8.0.0.x upgrade

SYMPTOM
In the ConfigTrace.log, the following exception can be seen:
==========================
[wsadmin] ADMA5016I: Installation of wps started.
[wsadmin] ADMA5058I: Application and module versions are validated with versions of deployment targets.
[wsadmin] ADMA5018I: The EJBDeploy program is running on file /var/tmp/app5791171104868981175.ear.
[wsadmin] Starting workbench.
[wsadmin] EJB Deploy configuration directory: /opt/IBM/WebSphere/AppServer/profiles/dmgrProfile/ejbdeploy/configuration/
[wsadmin] framework search path: /opt/IBM/WebSphere/AppServer/deploytool/itp/plugins
[wsadmin] build: RAD753-I20090617_1116
[wsadmin] An unexpected exception was thrown. Halting execution.
[wsadmin] Shutting down workbench.
[wsadmin] Error executing deployment: java.lang.IllegalStateException. Error is Platform not running.
[wsadmin] java.lang.IllegalStateException: Platform not running
[wsadmin] at org.eclipse.core.runtime.adaptor.EclipseStarter.run(EclipseStarter.java:374)
[wsadmin] at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
[wsadmin] at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
[wsadmin] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
[wsadmin] at java.lang.reflect.Method.invoke(Method.java:597)
[wsadmin] at com.ibm.etools.ejbdeploy.batch.impl.BootLoaderLoader.run(BootLoaderLoader.java:487)
[wsadmin] at com.ibm.etools.ejbdeploy.batch.impl.BatchDeploy.execute(BatchDeploy.java:106)
[wsadmin] at com.ibm.etools.ejbdeploy.EJBDeploy.execute(EJBDeploy.java:106)
[wsadmin] at com.ibm.etools.ejbdeploy.EJBDeploy.deploy(EJBDeploy.java:349)
[wsadmin] at com.ibm.etools.ejbdeploy.EJBDeploy.main(EJBDeploy.java:311)
[wsadmin] EJBDeploy level: @build@
[wsadmin] ADMA5008E: The EJBDeploy program failed on file /var/tmp/app5791171104868981175.ear. Exception: com.ibm.etools.ejbdeploy.EJBDeploymentException: Error executing EJBDeploy
[wsadmin] ADMA0063E: An error occurred during Enterprise JavaBeans (EJB) deployment. Exception: com.ibm.etools.ejbdeploy.EJBDeploymentException: Error executing EJBDeploy
[wsadmin] ADMA5011I: The cleanup of the temp directory for application wps is complete.
[wsadmin] ADMA5069E: The installation of application wps failed. This application was in the middle of a full update and therefore is uninstalled from the configuration session. Discard your current configuration session immediately to recover the application. Do not save changes to the WebSphere Application Server configuration repository. The application is not uninstalled from this repository. Until the current configuration session is discarded you do not see this application in the current session.
[wsadmin] WASX7017E: Exception received while running file "/opt/IBM/WebSphere/AppServer/profiles/wp_profile/ConfigEngine/config/work/was/curJaclScript.jacl"; exception information: com.ibm.ws.scripting.ScriptingException: WASX7418E: Application update for wps failed: see previous messages for details.

[wsadmin] WASX7341W: No "save" was performed before the interactive scripting session exited; configuration changes will not be saved.
/opt/IBM/WebSphere/AppServer/profiles/wp_profile/ConfigEngine/config/includes/apply_PTF.xml:59: Java returned: 105
==========================

CAUSE
This exception can happen during ejbdeploy after the WebSphere Application Server has been upgraded, and old OSGI cache remains for the ejbdeploy tool. The OSGI class of the ejbdeploy tool contains class information within the deploytool folder and can become stale if the content inside deploytool has changed.

RESOLVING THE PROBLEM
To resolve the problem, complete the following steps:

1. Delete/Remove the contents of the following directory EXCEPT for the 'config.ini' file, if it exists (the paths are different depending on your backend WAS version):

WebSphere Application Server v6.1.x:
<profile root>/deploytools/configuration

WebSphere Application Server v7.0.x:
<profile root>/ejbdeploy/configuration
<AppServer root>/deploytool/itp/configuration

WebSphere Application Server v8.0.x:
<profile root>/ejbdeploy/configuration
<AppServer root>/deploytool/itp/configuration

Cluster Environments: Do this for both the DMGR profile and the node profile.

Note: The deploytools and ejbdeploy directories may not exist on all nodes. They are created when ejbdeploy is executed successfully for the first time. If it has never been executed successfully in your environment, then the directories will not be there.

2. Re-attempt the WebSphere Portal upgrade.

 *
 *

Question: Why does my upgrade to Portal 8001 CF14 fail with the following errors, ADMA5008E, ADMA0063E, ADMA5069E, WASX7017E? Why does my upgrade to Portal 8001 CF14 fail with the following errors, ADMA5008E, ADMA0063E, ADMA5069E, WASX7017E?

Answer: This exception can happen during ejbdeploy after the WebSphere Application Server has been upgraded, and old OSGI cache remains for the ejbdeploy tool. The OSGI class of the ejbdeploy tool contains class information within the deploytool folder and can become stale if the content inside deploytool has changed.


IBM The affect of the auto-update feature for Oracle JDK 7 on IBM Mobile Foundation, IBM Worklight, IBM Worklight Foundation, and IBM MobileFirst Platform Foundation - United States  NEWS

ABSTRACT
 The IBM Mobile Foundation, IBM Worklight, IBM Worklight Foundation, and IBM MobileFirst Platform Foundation products support Oracle JDK 7, but do not support Oracle JDK 8.

CONTENT
On Windows operating systems, because the upgrade to Oracle JDK 8 is enabled by default, you might not be aware that the upgrade has occurred. This Oracle JDK 8 issue applies to the Mac OS as well.

SYMPTOM
You might see one of the following messages in the log file on Windows and Mac OS machines that originate from the WebSphere Application Server Liberty Profile:

 * TRAS0033E: Runtime injection of detailed method trace failed for class <class name> with exception <exception name>
 * CWWKC0044W: An exception occurred while scanning class and annotation data.

RESOLUTION
As stated on the Java SE at a Glance [http://www.oracle.com/technetwork/java/javase/overview/index.html] page, Oracle is automatically migrating users with the auto-update feature enabled from Oracle JDK 7 to Oracle JDK 8. However, a number of IBM and third-party dependencies for IBM Mobile Foundation, IBM Worklight, IBM Worklight Foundation, and IBM MobileFirst Platform Foundation do not support Oracle JDK 8.

 * Windows operating systems
   If you have already migrated to Oracle JDK 8, you need to revert to Oracle JDK 7 using the following steps:  1. Uninstall Oracle JDK 8.

    2. Download the latest version of Oracle JDK 7 from the Java SE Downloads [http://www.oracle.com/technetwork/java/javase/downloads/index.html] tab of the Oracle web site.

    3. Reinstall Oracle JDK 7.

   To disable the JDK auto-update feature on Windows operating systems, see the Change Automatic Update Settings [http://java.com/en/download/help/java_update.xml#adv] section of the Oracle Java Auto Update documentation.

 * Mac OS
   If you have already migrated to Oracle JDK 8, you need to revert to Oracle JDK 7 using the following steps:  1. Uninstall Oracle JDK 8. For more information, see the How do I uninstall Java 7 and later versions on my Mac? [https://www.java.com/en/download/help/mac_uninstall_java.xml] information on the Oracle web site.

    2. Download the latest version of Oracle JDK 7 from the Java SE Downloads [http://www.oracle.com/technetwork/java/javase/downloads/index.html] tab of the Oracle web site. For more information, see JDK 7 Installation for Mac OS X [http://docs.oracle.com/javase/7/docs/webnotes/install/mac/mac-jdk.html].

    3. Reinstall Oracle JDK 7.

   On the Mac OS operating system, you are explicitly asked if you want to update your Java version. Do not update the Java version to Java 8. To verify your Java version, see How do I update Java for my Mac? [https://www.java.com/en/download/help/mac_java_update.xml]

Cross reference information Segment Product Component Platform Version Edition Mobile- Speech and Enterprise Access IBM Worklight Security Mac OS X, Windows 6.2, 6.1, 6.0, 5.0.6, 5.0.5 Consumer, Enterprise Mobile- Speech and Enterprise Access IBM Mobile Foundation Security Mac OS X, Windows 6.0, 5.0.6, 5.0.5 Consumer, Enterprise

Question: Should I upgrade to Oracle JDK 8 if I am using IBM Mobile Foundation, IBM Worklight, IBM Worklight Foundation, or IBM MobileFirst Platform Foundation products? These is an upgrade available to replace Oracle JDK 7 with Oracle JDK 8. Does IBM Mobile Foundation, IBM Worklight, IBM Worklight Foundation, and the IBM MobileFirst Platform Foundation products support the use of Oracle JDK 8?

Answer: The IBM Mobile Foundation, IBM Worklight, IBM Worklight Foundation, and IBM MobileFirst Platform Foundation products support Oracle JDK 7, but do not support Oracle JDK 8.


IBM WebSphere Portal 7.0.0.2  Combined Cumulative Fix Readme - stand-alone - United States WPWCMCF WPWCMCF02 7002CCF PRODUCT README

ABSTRACT
 IBM WebSphere Portal 7.0.0.2 Combined Cumulative Fix stand-alone installation instructions for all editions, including WebSphere Portal Express.

CONTENT
7.0.0.2: Readme for IBM WebSphere Portal 7.0.0.2 Combined Cumulative fix - stand-alone

Table of Contents

 * About Combined Cumulative Fix #history
 * Space requirements
 * Cluster installation instructions [http://www.ibm.com/support/docview.wss?uid=swg27023911]
 * Steps for installing Combined Cumulative Fix
 * Steps for uninstalling Combined Cumulative Fix
 * #inst_clus#uninst_clusKnown issues
 * Change History
 * Additional information
 * Trademarks and service marks

About Combined Cumulative Fix

These are the instructions on how to install a WebSphere Portal Combined Cumulative Fix. The Combined Cumulative Fix is a package of WebSphere Portal fixes and Web Content Manager Cumulative fixes.

What's New

As of WebSphere Portal V7.0.0.2 Combined Cumulative Fix 26 (CF26), support has been added for syndicating to subscribers running WebSphere Portal V8.0.0.1 Combined Cumulative Fix 09 (CF09) or later.

Back to top

Space requirements

Ensure that enough disk space is available in the following directories:

z/OS: 625 cylinders in the directory where you download the cumulative fix, 625 cylinders in the <Portal Configuration HFS>, 625 cylinders in <WebSphere Configuration HFS> and 1250 cylinders in your system temp directory.

All other platforms: 2 GB in the directory where you download the cumulative fix, 1 GB in <Portal_Install_Root>, 1 GB in <wp_profile_root> temporary disk space and 1 GB in your system temp directory, such as /tmp on Unix or Linux platforms or C:\temp on the Microsoft Windows platform.

Back to top

Steps for installing Combined Cumulative Fix

BEFORE YOU BEGIN:
Familiarize yourself with the Portal Upgrade Best Practices available from IBM Remote Technical Support for WebSphere Portal.

Portal Upgrades: Best Practices for V7.0 [http://www.ibm.com/support/docview.wss?uid=swg21452611] For instructions on how to validate your environment prior to the upgrade, see the instructions for running the Health Checker tool for WebSphere Portal at:

Health Checker tool for WebSphere Portal V7.0 [http://www.ibm.com/support/docview.wss?uid=swg27020200] IMPORTANT: Certain security configurations can cause failures with the upgrade. Please check the following technote to see if this may apply to your environment.

Fix Pack 7.0.0.1 fails at action-import-defaultnodes-wp.filestore/base task. [http://www.ibm.com/support/docview.wss?uid=swg21496067]
 1. Perform the following steps before installing Combined Cumulative fix:
     1. Before you install this combined cumulative fix, check to see if the list of fixes already installed on your system is included in the list of fixes provided in this combined cumulative fix. If you have temporary, interim or cumulative fixes on your system that are not included in this Combined Cumulative Fix, then uninstall those fixes before installing this Combined Cumulative Fix and contact IBM Support for an updated version of that fix, or for more information.
     2. If you are running an external Web server such as IBM HTTP server, stop the Web server.
     3. Verify that the information in the wkplc.properties, wkplc_dbdomain.properties, wkplc_dbtype.properties, and wkplc_comp.properties files are correct. WebSphere Portal 7 introduced support for multiple profiles. If using multiple profiles, also verify that the information in each profile is correct. See the following link for multiple profiles Supporting multiple profiles: wp7 [http://www-10.lotus.com/ldd/portalwiki.nsf/dx/Supporting_multiple_profiles_wp7].  * Enter a value for the PortalAdminPwd and WasPassword parameters in the wkplc.properties file.
         * Ensure that the DbUser (database user) and DbPassword (database password) parameters are defined correctly for all database domains in the wkplc_dbdomain.properties file.
         * Unix/Linux/Windows/IBM i Only: The WebSphere Portal Update Installer removes plain text passwords from the wkplc*.properties files. To keep these passwords in the properties files, include the following line in the wkplc.properties file: PWordDelete=false.
         * Ensure that the value of the XmlAccessPort property in wkplc_comp.properties matches the value of the port used for HTTP connections to the WebSphere Portal server.

     4. Special considerations for multiple profiles or binary install or migration upgrade:  1. If you did a binary installation and created a WebSphere Portal profile later, or your Portal 7.0.0.x was migrated from 6.1.x, ensure that the PortalServer/wps.properties file correctly references the profile. The Portal Update Installer uses the wps.properties file to determine which profile is the primary profile to update. Failure to complete this step could result in an inoperable Portal server after the Combined Cumulative Fix installation completes.  1. Edit the <PortalServer root>/wps.properties file in a text editor
             2. Add these two properties if they do not already exist:
                ProfileName=<your profile name, e.g. wp_profile>
                ProfileDirectory=<your profile directory, e.g. /opt/IBM/WebSphere/wp_profile>

                Note: The ProfileDirectory property should use forward slash (/) instead of backslash (\) on Windows.

         2. If you have created multiple profiles. the Portal Update Installer will automatically upgrade all profiles. If you want to specify which profiles are updated, then complete the following steps:  1. Edit the <PortalServer root>/wps.properties file in a text editor
             2. Add this property if it does not already exist:
                AutoUpdateMultipleProfiles=<comma separated list of profile names, e.g. wp_profile, wp_profile2, wp_profile3>

         3. If using Multiple Profiles, verify all your profiles are at the same level before starting upgrade.

     5. Perform the following steps to download the Combined Cumulative Fix and the WebSphere Portal Update Installer:  1. Download the latest Combined Cumulative fix (e.g. 7.0.0.2-WP-WCM-Combined-CFPMnnnnn-CFnnn), and the latest WebSphere Portal Update Installer from http://www.ibm.com/support/docview.wss?uid=swg24027857 [http://www.ibm.com/support/docview.wss?uid=swg24027857].
         2. Create the PortalServer_root/update directory and extract the WebSphere Portal Update Installer file into this directory.
         3. Create the PortalServer_root/update/fixes directory and extract the 7.0.0.2-WP-WCM-Combined-CFPMnnnnn-CFnnn.zip file into this directory, where n is the numbers associated with the version of the Combined Cumulative fix. Note for z/OS users: refer to Installing interim fixes on WebSphere Portal Enable for z/OS using Portal Update Installer [http://www.ibm.com/support/docview.wss?uid=swg21326670] for detailed descriptions of how to execute steps ii. and iii. above.

2. Choose either the graphical user interface installation option or the command line installation option:

NOTE: Not all platforms can use the graphical user interface (IBM i and z/OS can only use command line).

NOTE: If the installation fails, use the IBM Support Assistant [http://www.ibm.com/software/support/isa/] to access support-related information and serviceability tools for problem determination. For IBM i, download ISA on a system other than IBM i. On the Support Assistant Welcome page, click Service. Then click the Create Portable Collector link to create a remotely collect the data from your IBM i system. Fix what is causing the problem and then rerun the installation task.

If using the Universal PUI, (which does not include the bundled Java environment), run the following command, setupCmdLine.bat for Windows or . ./setupCmdLine.sh for Unix/Linux from the was_profile_root/bin directory to set up the Java environment for the graphical user interface installation program. When updating a Portal that does not have a profile because it was installed with isBinaryInstall="true", then run setupCmdLine.bat|.sh from PortalServer_root/bin. z/OS users can not use the Universal PUI.

Enter the following command to launch the graphical user interface installation program:  *  Windows: PortalServer_root\update> updatePortalWizard.bat Unix/Linux: PortalServer_root/update> ./updatePortalWizard.sh

   - OR -
   Perform the following steps to launch the installation program from the command line:  1. Stop any active application servers using the stopServer command. To see which application servers are active use the serverStatus command.
    2. Enter the following command to launch the installation program (NOTE: Enter the command on one line):

    * Windows: PortalServer_root\update> updatePortal.bat -install
      -installDir "<PortalServer_root>"
      -fix
      -fixDir "<PortalServer_root>\update\fixes"
      -fixes < Cumulative fix >
    * Unix/Linux: PortalServer_root/update> ./updatePortal.sh -install
      -installDir "<PortalServer_root>"
      -fix
      -fixDir "<PortalServer_root>/update/fixes"
      -fixes < Cumulative fix >
    * IBM i: portal_server_root/update> updatePortal.sh -install
      -installDir "<portal_server_root>"
      -fix
      -fixDir "<portal_server_root>/update/fixes"
      -fixes < Cumulative fix >
    * z/OS: If the Health Checker Tool for WebSphere Portal V7.0 [http://www.ibm.com/support/docview.wss?uid=swg27020200] has not been run then it needs to be run before installing the Combined Cumulative Fix. Execute the following commands to install the Combined Cumulative Fix:  1. From <was_profile_root>/bin directory:
          . ./setupCmdLine.sh
       2. PortalServer_root/update> ./updatePortal.sh -install
          -installDir "<PortalServer_root>"
          -fix
          -fixDir "<PortalServer_root>/update/fixes"
          -fixes <Cumulative fix>

          Alternatively, the steps i. and ii. above can be executed via JCL. Customize the JCL samples from the following link: Installing interim fixes on WebSphere Portal Enable for z/OS using Portal Update Installer [http://www.ibm.com/support/docview.wss?uid=swg21326670]. Submit the JCLs, and then return here to continue.

   If you do not have any profiles at this point (because you are in the process of migration from WebSphere Portal 6.1 or Installing an additional node for a cluster or creating multiple profiles) no post installation steps are necessary and you can continue with the next steps that create the profiles as outlined by the according documentation.

   z/OS: If doing an upgrade as part of a migration from a previous version (eg. 6.x), run ./ConfigEngine.sh gather-migration-files command from the <wp_profile_root>/ConfigEngine directory.

   z/OS: Run the following command: <wp_profile_root>/PortalServer/bin/UpdateProfile.sh install CF skipPreCheckProfile

   All other platforms: To update a profile after an upgrade, the following command can be used to update profiles that are not included in AutoUpdateMultipleProfiles. All profiles that were not included in AutoUpdateMultipleProfiles need to be updated after the upgrade is done. All profiles must be at the same level for future upgrades to be applied. See the following link for multiple profiles Supporting multiple profiles: wp7 [http://www-10.lotus.com/ldd/portalwiki.nsf/dx/Supporting_multiple_profiles_wp7].

   <wp_profile_root>/PortalServer/bin/UpdateProfile.bat|.sh install CF

   This cumulative fix provides updates to OSGi bundles. After installing the cumulative fix, run "<profile location>/bin/osgiCfgInit.sh" (for IBM i the command is just osgiCfgInit, for Microsoft Windows the command is osgiCfgInit.bat) to clear the caches and make the OSGi container pick up the updates to the modified OSGi bundles. Note that it is recommended to stop the portal server before running the osgiCfgInit command.
 *
 *

3. Perform the following post installation steps:
 *  If you are running an external Web server such as IBM HTTP server and you are using the WebSphere Application Server automatic generation and propagation of the plugin, then just restart the Web server. If you are not using the automatic generation and propagation, then perform the following steps:
    1. Regenerate the Web server plugin.
    2. Copy the plugin-cfg.xml file to the Plugin directory.
    3. Restart the Web server.

   Redeploy your customization, including JSPs, to the WCM portlets if you are using Web Content Manager and you customized the portlets prior to installing the Combined Cumulative fix.  1. To update the deployed remote rendering portlet:  * Backup any files (e.g. custom JSPs) which have been copied to the deployed remote rendering portlet WAR directory
        * Log in to Portal as the Portal Administrator
        * Navigate to: Administration / Portlet Management / Web Modules
        * Find and select the remote rendering portlet web module
        * Click the Update Portlet Icon to the right of the selected portlet
        * Select the updated portlet WAR file located in: <PortalServer_root>/PortalServer/wcm/prereq.wcm/installableApps
        * Click Next and Finish

    2. To update the deployed PDM Doc List Portlet:  * Backup any files (e.g. custom JSPs) which have been copied to the deployed remote rendering portlet WAR directory
        * Log in to Portal as the Portal Administrator
        * Navigate to: Administration / Portlet Management / Web Modules
        * Find and select the PDM Doc List Portlet web module
        * Click the Update Portlet Icon to the right of the selected portlet
        * Select the updated portlet WAR file located in: <PortalServer_root>/PortalServer/wcm/prereq.wcm/installableApps
        * Click Next and Finish

    3. Log out of Portal for changes to take effect.

   Clear the browser cache before using the updated Web Content Manager. Review the following documentation "Configuration Changes and Options introduced in WP/WCM V7.0.0.1 and 7.0.0.2 Combined Cumulative Fixes" [http://www.ibm.com/support/docview.wss?uid=swg27021250] to see if it applies to your environment.

Back to top

Steps for uninstalling Combined Cumulative Fix

NOTE: Changing the server context root after upgrading is an unsupported uninstall path. To uninstall after changing the context root, you must first change the server context root back to the values of the previous version.

NOTE: Configuring Portal Server from a stand-alone environment to a cluster environment after upgrading is an unsupported uninstall path.

 1. Perform the following steps before you uninstall the Combined Cumulative Fix:  1. If you are running an external Web server such as IBM HTTP server, stop the Web server.
     2. Verify that the information in the wkplc.properties, wkplc_dbdomain.properties, wkplc_dbtype.properties, and wkplc_comp.properties files are correct. If using multiple profiles, also verify that the information in each profile is correct. See the following link for multiple profiles Supporting multiple profiles: wp7 [http://www-10.lotus.com/ldd/portalwiki.nsf/dx/Supporting_multiple_profiles_wp7].  * Enter a value for the PortalAdminPwd and WasPassword parameters in the wkplc.properties file.
         * Ensure that the DbUser (database user) and DbPassword (database password) parameters are defined correctly for all database domains in the wkplc_dbdomain.properties file.
         * If using a database other than the default, grant permissions to databases within the framework by setting the DbUser (database user) and DbPassword (database password) parameters in the wkplc_dbdomain.properties file.
         * Unix/Linux/Windows/IBM i Only: The WebSphere Portal Update Installer removes plain text passwords from the wkplc*.properties files. To keep these passwords in the properties files, include the following line in the wkplc.properties file: PWordDelete=false.
         * Ensure that the value of the XmlAccessPort property in wkplc_comp.properties matches the value of the port used for HTTP connections to the WebSphere Portal server.
         * WebSphere Portal 7 introduced support for multiple profiles. During the Combined Cumulative Fix uninstall the primary profile is downgraded first if one exists (The Update Installer also supports the update case for a binary only install without profiles). The primary profile is identified by two properties, ProfileDirectory and ProfileName. Ensure these properties are set before starting the downgrade process.
         * If using Multiple Profiles, verify all your profiles are at the same level before starting downgrade.

 2. Choose either the graphical user interface uninstallation option or the command line uninstallation option:

    NOTE: Not all platforms can use the graphical user interface (IBM i and z/OS can only use command line).

    NOTE: If the uninstallation fails, use the IBM Support Assistant [http://www.ibm.com/software/support/isa/] to access support-related information and serviceability tools for problem determination. For IBM i, download ISA on a system other than IBM i. On the Support Assistant Welcome page, click Service. Then click the Create Portable Collector link to create a remotely collect the data from your IBM i system. Fix what is causing the problem and then rerun the installation task.

    If using the Universal PUI, (which does not include the bundled Java environment), run the following command, setupCmdLine.bat for Windows or . ./setupCmdLine.sh for Unix/Linux from the was_profile_root/bin directory to set up the Java environment for the graphical user interface installation program. When updating a Portal that does not have a profile because it was installed with isBinaryInstall="true", then run setupCmdLine.bat|.sh from PortalServer_root/bin. z/OS users can not use the Universal PUI.
     * Enter the following command to launch the graphical user interface uninstallation program:  * Windows: PortalServer_root\update> updatePortalWizard.bat
        * Unix/Linux: PortalServer_root/update> ./updatePortalWizard.sh

          - OR -

     * Perform the following steps to launch the uninstallation program from the command line:  1. Stop any active application servers using the stopServer command. To see which application servers are active use the serverStatus command.
        2. Enter the following command to launch the uninstallation program (NOTE: Enter the command on one line):  * Windows: PortalServer_root\update> updatePortal.bat -uninstall
              -installDir "<PortalServer_root>"
              -fix
              -fixes < Cumulative fix >
            * Unix/Linux: PortalServer_root/update> ./updatePortal.sh -uninstall
              -installDir "<PortalServer_root>"
              -fix
              -fixes < Cumulative fix >
            * IBM i: portal_server_root/update> updatePortal.sh -uninstall
              -installDir "<portal_server_root>"
              -fix
              -fixes < Cumulative fix >
            * z/OS: If the Health Checker Tool for WebSphere Portal V7.0 [http://www.ibm.com/support/docview.wss?uid=swg27020200] has not been run then it needs to be run before uninstalling the Combined Cumulative Fix. Execute the following commands to uninstall the Combined Cumulative Fix:  1. From <was_profile_root>/bin directory:
                  . ./setupCmdLine.sh
               2. PortalServer_root/update> ./updatePortal.sh -uninstall
                  -installDir "<PortalServer_root>"
                  -fix
                  -fixes <Cumulative fix>

                  Alternatively, the steps i. and ii. above can be executed via JCL. Customize the JCL samples from the following link: Installing interim fixes on WebSphere Portal Enable for z/OS using Portal Update Installer [http://www.ibm.com/support/docview.wss?uid=swg21326670]. Submit the JCLs, and then return here to continue.

 3. Run the following command:  * z/OS: <wp_profile_root>/PortalServer/bin/UpdateProfile.sh uninstall CF skipPreCheckProfile
     * All other platforms: To downgrade a profile after an uninstall, the following command can be used to downgrade all profiles (including the primary profiles). See the following link for multiple profiles Supporting multiple profiles: wp7 [http://www-10.lotus.com/ldd/portalwiki.nsf/dx/Supporting_multiple_profiles_wp7].

       <wp_profile_root>/PortalServer/bin/UpdateProfile.bat|.sh uninstall CF

 4. If you are running an external Web server such as IBM HTTP server and you are using the WebSphere Application Server automatic generation and propagation of the plugin, then just restart the Web server. If you are not using the automatic generation and propagation, then perform the following steps:  1. Regenerate the Web server plugin.
     2. Copy the plugin-cfg.xml file to the Plugin directory.
     3. Restart the Web server.

 5. If you previously customized any configuration files in the wp_profile_root/PortalServer/config directory, check to see if uninstalling the cumulative fix affected those files by restoring a version of the files that was saved when the cumulative fix was originally installed. If it did affect the files, you must perform the same customization on the restored version of each file.
 6. Redeploy your customization, including JSPs, to the WCM portlets if you are using Web Content Manager and you customized the portlets prior to uninstalling the Combined Cumulative fix.  1. To update the deployed remote rendering portlet:  * Backup any files (e.g. custom JSPs) which have been copied to the deployed remote rendering portlet WAR directory
         * Log in to Portal as the Portal Administrator
         * Navigate to: Administration / Portlet Management / Web Modules
         * Find and select the remote rendering portlet web module
         * Click the Update Portlet Icon to the right of the selected portlet
         * Select the updated portlet WAR file located in: <PortalServer_root>/PortalServer/wcm/prereq.wcm/installableApps
         * Click Next and Finish

     2. To update the deployed PDM Doc List Portlet:  * Backup any files (e.g. custom JSPs) which have been copied to the deployed remote rendering portlet WAR directory
         * Log in to Portal as the Portal Administrator
         * Navigate to: Administration / Portlet Management / Web Modules
         * Find and select the PDM Doc List Portlet web module
         * Click the Update Portlet Icon to the right of the selected portlet
         * Select the updated portlet WAR file located in: <PortalServer_root>/PortalServer/wcm/prereq.wcm/installableApps
         * Click Next and Finish

     3. Log out of Portal for changes to take effect.

 7. Clear the browser cache before using the updated Web Content Manager.

Back to top

Known issues for latest Combined Cumulative Fix

Problem: There may be browser / functional issues in themes and in WCM when running 7002 CF levels against Internet Explorer 11 or Microsoft Edge.
Solution: It is recommended to run these browsers in compatibility mode as necessary. Also, note that some pieces of WCM functionality (exs. inability to close Workflow dialogs, Applet issues) may not work correctly with these browsers even in compatibility mode as they are not supported.

Problem: Inline help may not appear correctly after CF29 update on zOS.
Solution: From the <wp_profile_root>/ConfigEngine directory, run task

./ConfigEngine.sh expand-ear-wp.iehs.ear

Then restart the Portal server.

Problem: When using versions earlier than 'Java 6 update 45' or 'Java 7 update 51', a security pop-up dialog or error will be seen every time the WCM FileTransferApplet or Ephox EditLive editor is instantiated.
Solution: It is recommended to upgrade the Java runtime environment level to either 'Java 6 update 45' or 'Java 7 update 51' or later. Please refer to the following URL: swg21663838

Problem: After you enter a number into the number element/component, and then save the content/component more than twice, you will notice that the number field gets populated with some dots, i.e. 123.456.78. If you then click on Save again, you will get the following error:
'Enter a valid number. ( content/component name here)'
Solution: The workaround is to remove the dots and save again.

Problem: Page theme is changed to current Portal default theme when changing page content layout.
Solution: The workaround would be to change the page theme back to "Inherit Parent Theme". A fix for this issue is scheduled to be included in a future Combined CF.

Problem: After upgrading to a 7.0.0.2 Cumulative Fix and "Portal 7.0.0.2" theme has been set as the default portal theme, a user is unable to post to a blog or update a wiki using Microsoft Windows Internet Explorer.
Solution: Perform the following steps to resolve the issue:  1. Navigate to Administration -> Manage Pages -> Contenet_Root -> Hidden pages.
 2. Select "Edit Page Properties" for the hidden page named 'Web Content Management'.
 3. On the 'Edit page: Web Content Management' page, extend 'Theme:' drop-down list and select "-----Inherit Parent Theme-----".

Problem: WCM Authoring Search may not work after an upgrade to a 7.0.0.2 Cumulative Fix
Solution: Perform the following steps to resolve the issue:  1. Edit the <wp_profile>/PortalServer/jcr/lib/com/ibm/icm/icm.properties file in a text editor to verify all properties are correct.
 2. Set jcr.textsearch.enabled=true
 3. Change jcr.textsearch.indexdirectory to a corresponding location in the filesystem
 4. Restart your Portal Server.
 5. Create a new library or make changes in existing libraries

Problem: When configuring Portal for use with a remote DB2 on z/OS database, the sample job provided for the database creation does not contain the statements required to create the storage groups. These take the form:

CREATE STOGROUP group
VOLUMES(' volume')
VCAT category;
COMMIT;

where,
group is the name of the storage group for the database,
volume is the volume serial number of * to let SMS select the volume where the database will reside,
category is the category name of the Integrated Catalog Facility.

Solution: When using the EJPSCRDB sample job add the above statements for each storage group to the final version. These should be added at the beginning of "Step 2" of the sample job, just before the CREATE statements for the actual databases.

Problem: Theme Policies are not supported by the Portal 7.0.0.2 theme.
Solution: This is a known limitation.

Problem: Client-side aggregation is not supported by the Portal 7.0.0.2 theme.
Solution: This is a known limitation.

Problem: The WebSphere Portal 7.0.0.2 theme does not support Sametime 8.5.1
Solution: This is a known limitation.

Problem: Loading a page with the out of box default profile (Deferred) causes "dojo is not defined" error.
Solution: Dojo is not available in view mode using the Deferred profile, which is the default out of box. Switch the page or theme to use the Full profile to access Dojo in view mode. For more information see URL: http://www.lotus.com/ldd/portalwiki.nsf/dx/Creating_the_module_profile_sdoc [http://www.lotus.com/ldd/portalwiki.nsf/dx/Creating_the_module_profile_sdoc]

Problem: The Portal 7.0.0.2 drag-and-drop framework does not support multi-selection and copying resources.
Solution: This is a known limitation. This can be enabled by creating a custom drag and drop source and enabling these features.

Problem: The deploy-7002-theme task fails
Solution: The Portal 7.0.0.2 theme requires several artifacts from the "Page Builder" theme to exist on the server. If you have removed the theme or if you are coming from a migrated environment where the theme never existed, you will need to add the Page Builder theme back to the system before running the deploy-7002-theme task. Please see the "Additional instructions for a migrated environment" section at the following URL for more information http://www.lotus.com/ldd/portalwiki.nsf/dx/Installing_a_new_theme_sdoc [http://www.lotus.com/ldd/portalwiki.nsf/dx/Installing_a_new_theme_sdoc]

Problem: The Feedspace portlet in Portal 7.0.0.2 may show JavaScript issues.
Solution: The Feedspace portlet needs to be redeployed to resolve this. Use the Portal administration area to update the the SyndicatedFeedPortlet.war. Use the PortalServer/bp/wp.bp.feedspace/installableApps/SyndicatedFeedPortlet.war to do this update.

Problem: If a WCM cumulative fix is installed on a Websphere Portal 7.0.0.2 where the date of the install is later than the date on which the cumulative fix was packaged, then the update-wcm task will fail to overwrite the WCM war files from the base version.
Solution: To workaround this problem, the war files from [PortalServer]\wcm\prereq.wcm\installableApps have to be manually copied to [PortalServer]\installableApps. Once this is done, the update-wcm task will execute successfully.

Problem: Newly added WCM libraries might not be listed in the "Web Content Libraries" portlet on all nodes of the cluster due to an issue in cache replication.
Solution: The workaround would be to restart nodes which have the stale library list. A fix for this issue is scheduled to be included in a future Combined CF.

Problem: After uninstall of the combined cumulative fix, WPVersionInfo shows IBM WebSphere Portal Configuration Framework (CFGFW) at the upgraded version level.
Solution: This is expected. The CFGFW version level shown after the uninstall of the combined cumulative fix remains at the upgraded level. There is no functional problem.

Problem: If you plan to configure Computer Associates eTrust SiteMinder as your external security manager to handle authorization and authentication, the XML configuration interface may not be able to access WebSphere Portal through eTrust SiteMinder.
Solution: To enable the XML configuration interface to access WebSphere Portal, use eTrust SiteMinder to define the configuration URL (/wps/config) as unprotected. Refer to the eTrust SiteMinder documentation for specific instructions. After the configuration URL is defined as unprotected, only WebSphere Portal enforces access control to this URL. Other resources such as the /wps/myportal URL are still protected by eTrust SiteMinder. If you already set up eTrust SiteMinder for external authorization and you want to use XMLConfiguration Interface (xmlaccess), make sure you have followed the procedure to allow for xmlaccess execution.

Problem: If using the Firefox browser, portlets cannot be dragged to a page from the palette. It is necessary to click the + icon next to the portlet in the palette to add it to the page.
Solution: This is documented as a known limitation.

Problem: If an error is seen starting server "WebSphere_Portal" during the upgrade, a possible cause is that this server start is automatically enabled as part of the node reset state.
The error would appear similar to the following as part of the "action-start-portal-server-standard" task : "ADMU3027E: An instance of the server may already be running: WebSphere_Portal"
Solution: Log into the WAS Admin Console. Under Application Servers-> WebSphere_Portal, ensure that the Monitoring Policy for "Node restart state" is set to Stopped for all WebSphere Portal servers that are part of the environment.

For a list of known issues for Previous WebSphere Portal 7.0.0.2 Combined Cumulative Fixes, see IBM WebSphere Portal 7.0.0.2 Combined Cumulative Fix Previous Known Issues [http://www.ibm.com/support/docview.wss?uid=swg27023912]for details.

Back to top

Additional information
You can find additional information on the WebSphere Portal support page [http://www-306.ibm.com/software/genservers/portal/support/].

Back to top

Trademarks and service marks
For trademark attribution, visit the IBM Terms of Use [http://www.ibm.com/legal/us/] Web site.

Back to top

Question:
Installation of Portal 7.0 CF fails with version mismatch

Installation of Portal 7.0 CF fails with message,

"Profile version is not the same as portal binary version before updating portal binary."

Answer:
To update a profile after an upgrade, the following command can be used to update profiles that are not included in AutoUpdateMultipleProfiles. All profiles that were not included in AutoUpdateMultipleProfiles need to be updated after the upgrade is done. All profiles must be at the same level for future upgrades to be applied. See the following link for multiple profiles Supporting multiple profiles: wp7 [http://www-10.lotus.com/ldd/portalwiki.nsf/dx/Supporting_multiple_profiles_wp7].

   <wp_profile_root>/PortalServer/bin/UpdateProfile.bat|.sh install CF


IBM WebSphere DataPower M/T 9235 appliance might incorrectly report failure of both power supplies - United States  TECHNOTE (FAQ)

QUESTION
 The IBM WebSphere DataPower M/T 9235 appliance might incorrectly report the failure of both power supplies. This message is not reported on all appliances and can occur rarely in the field.

ANSWER
The following message would be present in the DataPower logs:

System power supply #2 has failed.

or logging event code:

0x80400022 System power supply #2

The problem can be confirmed by issuing the following commands on the appliance CLI:

co
test hardware
exit

The following output from the test hardware command confirms this problem:

[failure] Power supply '1' has no AC input power, or is not present.
[failure] Power supply '2' has no AC input power, or is not present.

Other results in the test hardware command might also show incorrect values.

This problem does not affect the operation of the appliance other than the continuous reporting power supply failure message.

To confirm the power supplies are working normally you may check the LED status on the power supplies. If the LED's are green the power supplies are working normally.

To recover from the false errors perform a reboot of the appliance:

From the WebGUI:

Control Panel → System Control → In the “Shutdown” section choose “Reboot System” then click “Shutdown”

From the CLI:

top

shutdown reboot

y

This problem is caused by a highly intermittent error that may allow the sensor reading mechanism to get into a bad state. This bad state then generates the false error messages. In most cases, a reboot of the appliance will reset the sensors and no additional errors are logged. The highly intermittent error rarely occurs again on the same appliance

If the issue reoccurs on the same appliance contact IBM DataPower support [http://www.ibm.com/support/docview.wss?uid=swg21236322] with the following information:

1) How many times have you seen the issue on the same appliance?

2) Gather the outputs for the following CLI commands:
show clock
show version
show ipmi
show sensors-other
config
service show
test hardware

Question:
I am receiving AC power supply failures on my DataPower 9235 appliance. How can I resolve this?

I am observing the following errors on my DataPower 9235 device:

[failure] Power supply '1' has no AC input power, or is not present. [failure] Power supply '2' has no AC input power, or is not present.

How can this be resolved?

Answer: In most cases, a reboot of the appliance will reset the sensors and no additional errors are logged.


IBM Default number of threads for ncp_poller - United States Available threads for ncp_poller TECHNOTE (FAQ)

QUESTION
 What are the number of threads assigned by default for ncp_poller? Is the same number of threads applicable for additional Pollers too?

ANSWER
There are 100 threads assigned for default Pollers in all three releases (v3.7, v3.8 & v3.9).
The additional poller is a new feature in v3.8 and higher versions, so additional Poller threads is not applicable for v3.7. But when you create additional pollers in v3.8/v3.9 same # of thread (i.e. 100) pool is assigned.

In v3.8, v3.9 - you can also increase the default 100 to a higher value by modifying and uncommenting the following line in $NCHOME/etc/precision/NcPollerSchema.cfg
//update config.properties set BatchExtraThreads = 150;

Question:
ncp_poller failed with Out-of-memory in ITNM 3.9 FP4+IF1. What went wrong?.

ncp_poller is failed with out-fo-memory even if we have ITNM 3.9 FP4+IF1 latest FP

2016-04-11T03:02:09: Fatal: F-RIV-002-014: [31869t] CRivError.cc(386) Out-of-memory - This process has run out of memory or exceeded the operating system memory limit for a 32 bit application - You must take action to reduce the amount of data this application is having to process new handler called

How to resolve this issue?.

Answer:
There are 100 threads assigned for default Pollers in all three releases (v3.7, v3.8 & v3.9).
The additional poller is a new feature in v3.8 and higher versions, so additional Poller threads is not applicable for v3.7. But when you create additional pollers in v3.8/v3.9 same # of thread (i.e. 100) pool is assigned.

In v3.8, v3.9 - you can also increase the default 100 to a higher value by modifying and uncommenting the following line in $NCHOME/etc/precision/NcPollerSchema.cfg
//update config.properties set BatchExtraThreads = 150;


IBM Some portal resources have been updated, however a long cache was set so the updates are not being served. - United States  TECHNOTE (FAQ)

QUESTION
The resolver uses the digest to cache some URLs like resource aggregator collections, and the digest remains the same between restarts. Resources like theme files are served from the browser or proxy cache (HTTP 304) and not loaded from the server.

ANSWER
The resolver uses the digest to cache some URLs like resource aggregator collections, and the digest remains the same between restarts.
In order to force a digest change (should some resources have changed and a long cache was set), you can set the "digest.seed" key in the WP ConfigService to any string value, which will be used in generating a new digest on server boot. This will force a digest change when you want a new one during a restart.

Changing the digest setting generates different URLs, so the updated theme resources can be loaded from the server.

Question:
Why Theme Updates are not updated in the browser cache ?

If you change graphics in page header. Then packed the war file and update it via the Integrated Solutions Console. But the old graphic is still displayed until the user press Ctrl + F5 in Internet Explorer.

Answer: Changing the digest setting generates different URLs, so the updated theme resources can be loaded from the server.


Question: Updating SCA applications & internal SCA module queues When updating an existing SCA module using the ISC, I noticed that internal SCA queues (sca/<module>/...) on the SCA.SYSTEM bus) are deleted and recreated.  One can potentially loose messages on these queues. Is there a fix to the problem?

Answer: To resolve this issue, use the SCA.recycleDestinations custom Java™ virtual machine (JVM) property for the module. Set the property to false to preserve SCA destinations.